Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to setup an OpenVPN server but I'm stuck with routing problem...

This my network configuration:

Client(172.17.17.6)<->Router+Firewall<->OVPN Srv(WAN:197.174.211.77)<->Subnet A 197.174.211.0/255.255.255.224 AND Subnet B 197.174.211.64/255.255.255.224

I can connect to the server and get an IP but I can't access to servers on both subnets. I made sure that the OpenVPN can ping, wget etc to servers in Subnet A and B.

Here is my server configuration:

port 1194
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
server 172.17.17.0 255.255.255.0
ifconfig-pool-persist ipp.txt
route 197.174.211.0 255.255.255.224
route 197.174.211.64 255.255.255.224
push "route 197.174.211.0  255.255.255.224"
push "route 197.174.211.64  255.255.255.224"
client-to-client

duplicate-cn

keepalive 10 120
comp-lzo
max-clients 20
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status-tcp.log
log-append /var/log/openvpn-tcp.log
verb 5

My server route table:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.17.17.2     *               255.255.255.255 UH    0      0        0 tun0
197.174.211.64  172.17.17.2     255.255.255.224 UG    0      0        0 tun0
197.174.211.64  *               255.255.255.224 U     0      0        0 eth0
172.17.17.0     172.17.17.2     255.255.255.0   UG    0      0        0 tun0
default         197.174.211.65  0.0.0.0         UG    0      0        0 eth0

When I do

cat /proc/sys/net/ipv4/ip_forward
1

So I guess ip_forward is activated...

I see that OpenVPN receives traffic from the tunnel but doesn't forward it...

**root@vpn:/etc/openvpn# tcpdump -i tun0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
15:24:42.913610 IP 172.17.17.6 > : ICMP echo request, id 1, seq 729,   length 40
15:24:47.743495 IP 172.17.17.6 > 197.174.211.11: ICMP echo request, id 1, seq 730, length 40

But I got no response in my client :-(

I'm not using iptables or any firewall on my server...

Does anyone have an idea?

Thank you very much for your help

Phil.

Config : Debian 6.0.5, openvpn from apt

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.